Subject: RE: [ipcdn] draft-ietf-ipcdn-device-mibv2-01.txt

From: "Woundy, Richard" <[email-masked]>
Date: Thu, 18 Apr 2002 10:45:54 -0600

Ran,

I am looking at the BGP MIBs, and don't see any language about SNMPv2c and
its lack of real security.

"Definitions of Managed Objects for the Fourth Version of Border Gateway
Protocol (BGP-4)"
<http://www.ietf.org/internet-drafts/draft-ietf-idr-bgp4-mib-09.txt>

"Definitions of Managed Objects for the Fourth Version of Border Gateway
Protocol (BGP-4), Second Version"
<http://www.ietf.org/internet-drafts/draft-ietf-idr-bgp4-mibv2-02.txt>

Am I looking at the right documents?

In the meantime:
- I am advancing some WG documents (DOCSIS IGMPv2 MIB and Subscriber
Management MIB) that use the text in <http://www.ops.ietf.org/security.html>
(no mention of SNMPv2c).
- I am drafting an email for <[email-masked]> asking about adding the
text about SNMPv2c being as insecure as SNMPv1, that I will send out today.

-- Rich

-----Original Message-----
From: RJ Atkinson [mailto:[email-masked]]
Sent: Tuesday, March 19, 2002 3:23 PM
To: 'Richard Woundy'
Cc: [email-masked]'
Subject: Re: [ipcdn] draft-ietf-ipcdn-device-mibv2-01.txt

On Tuesday, March 19, 2002, at 02:40 , Richard Woundy wrote:
> I want to put together an updated version of this internet-draft.

	Thanks very much.  My primary goal is to keep the I-Ds (and
RFCs) in sync with the current reality.

> The wording of the Security Considerations in the drafts in this
> working group is constrained by the following guidance for MIB
> documents from the IETF O&M folks: <http://www.ops.ietf.org/security.html>
> .

> If we want to use text that specifically calls out the dangers/folly
> of using SNMPv2c, we should get feedback from the folks on the
> <[email-masked]> mailing list.

	I believe, based on recent experience with the BGP MIB where
I had essentially the same inputs and my proposal was recently
implemented, that my suggestion regarding "Security Considerations"
for IPCDN MIBs is not conflicting with the URL/guidance from the
MIB wizards.  One could send a quick note to the O&M ADs to obtain
precise confirmation that I am not confused about this point.

	A glance at the very very latest BGP MIB's "Security
Considerations" gives a good example of the kind of things
that I think ought to be there.  I believe this latest I-D's
version is online already, but am not 100% certain this second
as I write this note.

Cheers,

Ran
[email-masked]

_______________________________________________
IPCDN mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipcdn

---

From: RJ Atkinson <[email-masked]>
Date: Thu, 18 Apr 2002 13:11:42 -0400

> its lack of real security.

Apparently some of my inputs were ignored/watered-down.  I'll go
email the BGP folks again to remind them...

The stuff that *is* in the Security considerations in -09 of the BGP
MIB is a starting point, in that it discusses specific objects
and why those particular objects have specific described security
risks.

Ran

---

From: RJ Atkinson <[email-masked]>
Date: Thu, 18 Apr 2002 13:11:42 -0400

Ran